131–140 of 326 posts
Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.
I remember seeing a research group that was working on creating an out of band password prompt for desktop computers at NC State. Basically the OS had a syscall to pause everything the kennel included and a separate module would basically dim the screen and show the password prompt over what was currently on the screen. I forget the exact details but it was neat.
Perhaps you're referring to Windows? (I'm not trying to be snarky, a lot of people here genuinely don't use Windows) System security related prompts have worked essentually as you describe on Windows since 2001.
I imagine if you had a password prompt LED on your device that could only be lit up by the separate chip that does password prompts, that would help create an off screen UI.
Earlier quoted context omitted.
> doesn't work when UAC is enabled Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.
I could understand disabling UAC on Vista, but I find it perfectly sensible since Win7. Also blame ancient programs which request administrator access without reason.
funny thing is, the thing that made it "sensible" since win7 also makes it insecure. if you care about security, it's prompt for everything or nothing.
https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=...
The reactions I have regarding the urgency of this are: 1) Have there in fact been any known phishing attacks in Apple's App Store using this method? 2) Wouldn't Apple's app review usually notice something like this before allowing it into the store?
> 1) Have there in fact been any known phishing attacks in Apple's App Store using this method? no attacks are known. But that doesn't mean a thing. It's very easy to do this, so you'd have to assume that it is being done. > 2) Wouldn't Apple's app review usually notice something like this before allowing it into the store? no. As the article says, this kind of functionality is incredibly easy to hide.
What does Apple review when approving apps?
Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?
That's only if you're using a third-party keyboard, I think.
On iOS the test of pressing the home button and see if the app goes in background seems a pretty strong one. Perhaps in a future Apple can make you press the home button as part of the verification, so it’s kind of implicit.
I think this is the best solution so far!
On iOS the test of pressing the home button and see if the app goes in background seems a pretty strong one. Perhaps in a future Apple can make you press the home button as part of the verification, so it’s kind of implicit.
Good luck doing it on iphone x.
This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
Still might fool some users who aren't paying attention but seems like it would be a simple start.
Dialogs owned by the OS should probably pull the drawer down and display in there. The simplest way is not allowing the application to access some sacred part of the UI, and putting system stuff there. Same thing web browsers do.
A phishing dialog could fake the drawer. Apps can and do regularly use the full screen which is something web pages don't do and which will require extra user confirmation for precisely this reason. Denying apps full screen access is very detrimental to the overall UX so that's not going to happen. The other solution is to have apple never prompt for that password aside of during the initial setup process after insta…
Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?